This is a basic configuration that will save all your sync resources to /path/to/example.db.
After running cloudquery sync, you can explore the data locally with the DuckDB CLI: duckdb /path/to/example.db.
The default write_mode is overwrite-delete-stale, but the plugin also supports overwrite or append. Note that overwrite and overwrite-delete-stale modes do not support atomic updates: to update a resource, it is first deleted and then re-inserted. This is due to a current lack of support in DuckDB for upserting list-type columns. If this is an issue for you, consider using the append mode instead. You may then perform a manual cleanup of stale resources after the sync completes.
The plugin needs to be authenticated with your account(s) in order to sync information from your cloud setup.
The plugin requires only read permissions (we will never make any changes to your cloud setup), so, following the principle of least privilege, it's recommended to grant it read-only permissions.
There are multiple ways to authenticate with AWS, and the plugin respects the AWS credential provider chain. This means that CloudQuery will follow the following priorities when attempting to authenticate:
- The
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN environment variables.
- The
credentials and config files in ~/.aws (the credentials file takes priority).
- You can also use
aws sso to authenticate cloudquery - you can read more about it here (opens in a new tab).
- IAM roles for AWS compute resources (including EC2 instances, Fargate and ECS containers).
You can read more about AWS authentication here (opens in a new tab) and here (opens in a new tab).
Environment Variables
CloudQuery can use the credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and
AWS_SESSION_TOKEN environment variables (AWS_SESSION_TOKEN can be optional for some accounts). For information on obtaining credentials, see the
AWS guide (opens in a new tab).
To export the environment variables (On Linux/Mac - similar for Windows):
Shared Configuration files
The plugin can use credentials from your credentials and config files in the .aws directory in your home folder.
The contents of these files are practically interchangeable, but CloudQuery will prioritize credentials in the credentials file.
For information about obtaining credentials, see the
AWS guide (opens in a new tab).
Here are example contents for a credentials file:
You can also specify credentials for a different profile, and instruct CloudQuery to use the credentials from this profile instead of the default one.
For example:
Then, you can either export the AWS_PROFILE environment variable (On Linux/Mac, similar for Windows):
or, configure your desired profile in the local_profile field:
IAM Roles for AWS Compute Resources
The plugin can use IAM roles for AWS compute resources (including EC2 instances, Fargate and ECS containers).
If you configured your AWS compute resources with IAM, the plugin will use these roles automatically.
For more information on configuring IAM, see the AWS docs here (opens in a new tab) and here (opens in a new tab).
User Credentials with MFA
In order to leverage IAM User credentials with MFA, the STS "get-session-token" command may be used with the IAM User's long-term security credentials (Access Key and Secret Access Key). For more information, see here (opens in a new tab).
Then export the temporary credentials to your environment variables.
